CVE-2012-4199 Information disclosure in n/a

Medium 4.3 Published 16 Nov 2012 Updated 6 Aug 2024

Remote attackers can read private product or component names from HTML source code in Bugzilla when custom-field visibility controls are used.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2012-4199?

CVE-2012-4199 is a medium-severity vulnerability in Mozilla Bugzilla, published on 16 Nov 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.

Weakness: CWE-200

Which versions are affected by CVE-2012-4199?

It affects 1 product.

Products include Mozilla Bugzilla.

How do I fix CVE-2012-4199?

No fix has been published for CVE-2012-4199 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-4199 being exploited?

There is no known exploitation of CVE-2012-4199 in the wild and no public exploit code.

All Mozilla Bugzilla vulnerabilities

Sources

Also known as GHSA-qjc8-mcp6-hq6r.